Is there hope for IPv6? • Hacker News Board

Re: Is there hope for IPv6?

#171

Post by phicoh » Sat, Jan 05, 2019, 7:56 PM UTC

gregmac wrote: post #134

phicoh wrote: post #116

Earlier quoted context omitted.

There are 3 problems with IPv6 - There is a lot in IPv6 that is different from IPv4. Ignoring if those changes are good or bad, it does make the transition harder. - IPv6 was promoted way before there was demand. To some extent it is good to prepare people (and vendors). But it does create the impression that IPv6 is a failure - Demand for IPv6 is highly asymmetrical. The party that is out of IPv4 addresses needs IPv…

- No transition or migration design. It seems like IPv6 was designed as if it was being built instead of building IPv4, and didn't consider how the move would happen beyond something like "everyone run dual-stack IPv4/IPv6, and once that's at 100% we'll turn off IPv4." This results in a stale-mate of sorts: As a server operator, as long as you have IPv4-only clients, you need an IPv4 address. There are no [1] IPv6-on…

To some extent this is unavoidable. Anything that is 'IPv4-like with larger addresses' is very much incompatible with any IPv4 equipment or setup at the edge.

You could design something where the IPv4 could be left unchanged in the core of the Internet. But the core of the Internet has supported IPv6 for a long time, it is the edges where the problems are.

Just something as simple as writing an address to a log file would fail if addresses suddenly became bigger.

Re: Is there hope for IPv6?

#172

Post by phicoh » Sat, Jan 05, 2019, 8:00 PM UTC

hn_throwaway_99 wrote: post #129

phicoh wrote: post #116

Earlier quoted context omitted.

There are 3 problems with IPv6 - There is a lot in IPv6 that is different from IPv4. Ignoring if those changes are good or bad, it does make the transition harder. - IPv6 was promoted way before there was demand. To some extent it is good to prepare people (and vendors). But it does create the impression that IPv6 is a failure - Demand for IPv6 is highly asymmetrical. The party that is out of IPv4 addresses needs IPv…

> For the last couple of years we now have a mature market for IPv4 addresses. Which highlights the utter failure of v6 - people are willing to pay for access to technology that v6 was supposed to make obsolete over a decade ago.

I disagree. You have to consider network effects. Even if IPv6 was completely perfect, switching on your own doesn't do any good. You need to get most of the network to switch to get the benefits.

Given that there is always a cost to switching, people will consider switching when continuing on the old path will become more costly than switching.

Re: Is there hope for IPv6?

#173

Post by geofft » Sat, Jan 05, 2019, 8:00 PM UTC

Dagger2 wrote: post #138

paulddraper wrote: post #84

Earlier quoted context omitted.

I always wish IPv6 had done example this -- use 64 bits. The address space is still enormous: a couple billion for every currently living person (yes, I know allocating isn't 100% efficient, but even at 0.001% efficiency, that's still tens of thousands per capita). And, the address could fit in a common word size, and be significantly more readable. As is, IPv6's one-address-per-atom-on-Earth is unnecessary, the addr…

64 bits probably wouldn't be enough to let people avoid going into address conservation mode though. Heck, there are way too many ISPs allocating a single /64 in v6 land today , and there's far more space available in v6 today than there would be after 100+ years of your 64-bit space. Having an unnecessarily large amount of addresses is a good thing, because the alternative is to have too few addresses. You don't wan…

They're allocating /64s because a lot of the design of IPv6 (SLAAC, for instance) makes it easy to do one /64 per customer who would have been doing IPv4 NAT. And the rest of the world bakes assumptions around this; for instance, IPv6 spam blacklists generally operate at /64 granularity because that's assumed to be one customer, so if customers get anything smaller like /96s or even /128s, unrelated customers will share spam reputation.

In a world where we kept the IPv4 worldview of NATs and just added more addresses, a 64-address space would be fine for the same reasons that /64s are fine in IPv6 today.

And the holdup on IPv6 rollout isn't related to it being a longer address space at all.

Re: Is there hope for IPv6?

#174

Post by wmf » Sat, Jan 05, 2019, 8:01 PM UTC

geofft wrote: post #130

phicoh wrote: post #116

Earlier quoted context omitted.

There are 3 problems with IPv6 - There is a lot in IPv6 that is different from IPv4. Ignoring if those changes are good or bad, it does make the transition harder. - IPv6 was promoted way before there was demand. To some extent it is good to prepare people (and vendors). But it does create the impression that IPv6 is a failure - Demand for IPv6 is highly asymmetrical. The party that is out of IPv4 addresses needs IPv…

Why is IPv6 more attractive for address exhaustion than IPv4 NAT? As the article argues, you can't run IPv6-only. You need some strategy to reach IPv4 services on the internet because the internet is IPv4. That answer is going to be either publicly routable IPv4, IPv4-to-IPv4 NAT, or IPv4-to-IPv6 NAT. If you do the latter (or if you do dual stack) you can route directly to other IPv6 hosts without NAT - but what's th…

Native IPv6 is cheaper than NAT at ISP scale. If a consumer ISP adopts IPv6, half of their traffic will be native IPv6 without NAT. If the ISP tries to do NAT444 then all of their traffic will be NATed, requiring more equipment.

Re: Is there hope for IPv6?

#175

Post by geofft » Sat, Jan 05, 2019, 8:02 PM UTC

Pxtl wrote: post #47

dpark wrote: post #19

Earlier quoted context omitted.

IPv4 is for machines. IP addresses were never intended for humans, which is why domain names exist.

Except that setting up domain names for devices in your network is out of reach for most humans, while IP addresses are trivial. My cheap router that I have to reboot nightly lets me bind an ipv4 address to every device on the network so I have known address for everything. There is no comparable functionality for a domain name, or a subdomain or whatever. If my ISP offered free dyndns (and there was a well-adopted g…

FWIW my consumer router offers free dynamic DNS for my public IP under asuscomm.com. I've had the router since January 2014 and it still works.

Most consumer routers I've seen offer automatic private DNS based on the DHCP option for registering a hostname.

Re: Is there hope for IPv6?

#176

Post by Dagger2 » Sat, Jan 05, 2019, 8:04 PM UTC

zamadatix wrote: post #148

Dagger2 wrote: post #133

Earlier quoted context omitted.

Except NAT gives no security, because NAT doesn't block packets. If a packet comes in that doesn't match any NAT state, then the packet isn't dropped on the floor -- it's processed as normal like any other packet would be, and in the absence of a firewall (which is logically separate, even if often implemented in the same software stack) it'll be routed to whatever the destination in the packet header is.

"If a packet comes in that doesn't match any NAT state, then the packet isn't dropped on the floor" Yes it is, it's the same scenario as if there was no route to the destination just at a higher abstraction layer. Think about it this way: a packet just hit the NAT IP from the internet, the packet has hit it's destination. There was no NAT table match for the packet so it was not rewritten. Where would the packet be f…

It's not the same scenario at all. If there's no route to the destination then the packet will necessarily be dropped, but with no matching NAT state table entry for a packet all that happens is that the dst header field is left alone.

There will still be an IP in the dst header field! The router will still deliver the packet to that IP, subject to all the usual constraints (e.g. it needs a valid route etc). NAT won't stop that; only a firewall will.

Re: Is there hope for IPv6?

#177

Post by drewg123 » Sat, Jan 05, 2019, 8:04 PM UTC

geofft wrote: post #31

Dylan16807 wrote: post #27

Earlier quoted context omitted.

What does a system that does take those incentives into account look like?

Loose coupling and no second system effect. IPv6 should have been extended address space and extended address space only, in a manner backwards-compatible with IPv4. You think ARP is broken? Great, implement a fixed version of ARP for both IPv4 and IPv6, meanwhile we'll spec IPv6 to use ARP. Don't design IPv6 to use your new thing called NDP that layers completely differently. You think everyone using NAT is wrong? G…

I agree with you 100%

The other thing that V6 does that it should never have done is the extension header nonsense. That makes it possible to layer protocol inside protocol essentially forever. Hardware designers just love this feature. In practice, a lot of hardware vendors do not support it and just punt to exception cases when they hit an extension header. I'm a little surprised that that there isn't some widespread DOS that involves extension header handling botches.

Re: Is there hope for IPv6?

#178

Post by geofft » Sat, Jan 05, 2019, 8:05 PM UTC

z3t4 wrote: post #159

geofft wrote: post #52

Earlier quoted context omitted.

You could, but does your device actually do so? Are you confident that 100% of the devices you own use privacy addresses and do not leak non-privacy addresses? The nice thing about IPv4 NAT is that you plug a single gadget in to your ISP's connection (cable modem, ONT, whatever), you connect your devices to that gadget, and it works out of the box and has all the security properties you'd expect, even if you're a per…

One problem with IPv4 is that each interface can only have one IP. With IPv6 an interface can have many! For example both a private and a public IP address!

?? multiple IPv4 addresses work fine... ip addr add 192.0.2.2 dev eth0

It's true that IPv6 requires IP stacks to support this, but nothing in IPv4 prevents IP stacks from supporting it.

Re: Is there hope for IPv6?

#179

Post by phicoh » Sat, Jan 05, 2019, 8:10 PM UTC

geofft wrote: post #130

phicoh wrote: post #116

Earlier quoted context omitted.

There are 3 problems with IPv6 - There is a lot in IPv6 that is different from IPv4. Ignoring if those changes are good or bad, it does make the transition harder. - IPv6 was promoted way before there was demand. To some extent it is good to prepare people (and vendors). But it does create the impression that IPv6 is a failure - Demand for IPv6 is highly asymmetrical. The party that is out of IPv4 addresses needs IPv…

Why is IPv6 more attractive for address exhaustion than IPv4 NAT? As the article argues, you can't run IPv6-only. You need some strategy to reach IPv4 services on the internet because the internet is IPv4. That answer is going to be either publicly routable IPv4, IPv4-to-IPv4 NAT, or IPv4-to-IPv6 NAT. If you do the latter (or if you do dual stack) you can route directly to other IPv6 hosts without NAT - but what's th…

There are a couple of reasons:

- There are limits to how many devices you can put behind a single IPv4 address. There is the case of Belgium where law enforcement asked ISPs to limit CGNAT to 16 customers per IPv4 address. Obviously for law enforcement, if an address is shared between multiple customers it makes investigations harder.

- A second problem it that you may lose geographical resolution if customers for a wide area share a pool of addresses. For some ad placement you really want to know where addresses are.

- But the bigger problem is that network speeds keep growing. Compared to an IPv6 router, boxes that can do NAT at a large scale and high speed are quite expensive. So an ISP has an incentive to move traffic volume to IPv6. Relatively low volume oddball sites can go over the NAT box.

Re: Is there hope for IPv6?

#180

Post by Dagger2 » Sat, Jan 05, 2019, 8:11 PM UTC

amluto wrote: post #161

gregmac wrote: post #110

Earlier quoted context omitted.

NAT is only painful for applications that implement arbitrary inbound connections, such as peer-to-peer connections, and applications that use separate control/data connections. The former is understandable because it's necessary, the latter is arguably lazy application developers. Peer-to-peer is largely solved with UPnP port forwarding, but most of these apps can also at least be configured to use a specific port r…

> Peer-to-peer is largely solved with UPnP port forwarding, but most of these apps can also at least be configured to use a specific port range, education can then be configured on the router to forward. Until Comcast helpfully replaces the cable modem in a working setup with a router/WiFi/hotspot abomination, so the network ends up double-NATted, and anything that tries to punch through UPnP- or TURN-style stops wor…

And then puts you behind CGNAT after they run so low on addresses that they don't even have enough for one per customer, giving you triple NAT with one of the NATs being completely out of your control. Good luck getting anything through that.